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AMENDMENTS TO THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the application: 
Listing of Claims : 

1 . (Currently amended) A method performed by one or more server devices, the 
method comprising: 

collecting, by one or more processors of the one or more server devices, information 
associated with a group of users visiting a web site that includes an advertising link, where the group 
of users visiting the web site includes a set of non-malicious users and a different set of malicious 
users , where the collecting information includes tracking activities of the group of users visiting the 
web site ; 

identifying, by one or more processors of the one or more server devices, the set of 
non-malicious users visiting the web site from the group of users visiting the web site based at least 
in part on the collected information; 

where the tracking activities includes at least one of: 

determining whether images are loaded by the users, in the group of users, 
where identifying the set of non-malicious users includes identifying users, in the group of users, 
that are determined as loading images, where the set of non-malicious users includes the users that 
are determined as loading images, 

determining whether the users, in the group of users, have javascript turned 
on, where identifying the set of non-malicious users includes identifying users, in the group of users, 
that are determined as having javascript turned on, where the set of non-malicious users includes the 
users that are determined as having javascript turned on, 

determining a type of browser used by the users, in the group of users, where 
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identifying the set of non-malicious users includes identifying users, in the group of users, that are 

determined as using a browser, where the set of non-malicious users includes the users that are 

determined as using a browser, 

determining a number of times during an interval that users, in the group of 

users, visit the web site, where identifying the set of malicious users includes identifying a first set of 

users, in the group of users, that are determined to have visited the web site a number of times, 

during the interval, that exceeds a threshold number of times, where the set of non-malicious users 

includes a second set of users, in the group of users, that is different from the identified first set of 

users, 

determining, when the web site is associated with a search engine, a type of 
items for which searches are performed by the users in the group of users, where identifying the set 
of malicious users includes identifying a first set of users, in the group of users, that arc determined 
to have performed searches in an ordered manner, where the set of non-malicious users includes a 
second set of users, in the group of users, that is different from the first set of users, or 

identifying non-malicious users based on an age of cookie identifiers 
associated with the users in the group of users; 

identifying determining , by one or more processors of the one or more server devices, 
an estimated click rate of an advertisement, the estimate click rate being equal to a first proportion of 
a quantity of non-malicious users visiting the web site to a total quantity of users visiting the web 
site; 

detecting determining , by one or more processors of the one or more server devices, 
an occurrence of spamming of the advertising link on the web site, where the detecting determining 
includes: 
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identifying a second proportion of a quantity of clicks on the advertising link 

by identified non-malicious users to a total quantity of clicks on the advertising link by the group of 

users, [[and]] 

comparing the determined estimated click rate identified first proportion to the 
identified second proportio n, and 

determining that the spamming has occurred when the determined estimated 
click rate is greater than the identified second proportion ; and 

taking a remedial measure when the occurrence of spamming on the web site website 

2-7. (Canceled herein) 

8. (Currently amended) The method of claim [[2]] L, where the tracking activities 
further includes: 

tracking activities of users^. in the group of users^. visiting another web site. 

9. (Canceled herein) 

10. (Canceled herein) 

1 1 . (Currently amended) The method of claim 1 A whore each of the users in the group of 
users is associated with a network address, and whoro the identifying non malicious users includes 
further including : 
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identifying the non-malicious users based at least in part on [[the]] network 
addresses associated with the users in the group of users. 

12-14. (Previously canceled) 

15. (Currently amended) The method of claim l a where the determining detecting the 
occurrence of spamming on the web site includes: 

detecting determining an occurrence of spamming of at least one advertisement on the 

web site, and 

where taking the remedial measure comprises: 

providing a refund in response to detecting determining that the at least one 
advertisement has been spammed. 

16-18. (Canceled herein) 

19. (Currently amended) A method performed by one or more server devices, the method 
comprising: 

identifying, by one or more processors of the one or more server devices, a group of 
non-malicious users visiting a web site , where the identifying includes: 

tracking an activity of users visiting the web site, where the tracking includes 
determining, for each user, at least one of whether the user loads images, an age of a cookie 
associated with the user, whether the user has javascript turned on, a type of browser used by the 
user, or an interval at which the user visits the web site, and 
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identifying the group of non-malicious users based on the tracked activity, 
where the group of non-malicious users includes users that load images, have a cookie that is older 
than a predetermined age, have javascript turned on, are using a predetermined type of browser, or 
have visited the web site at an interval that exceeds a threshold interval ; 

determining, by one or more processors of the one or more server devices, [[a]] an 
estimated click rate of an advertisement item associated with the web site for the group of non- 
malicious users , where the determining the estimated click rate includes: 

estimating a percentage of non-malicious visitors visiting the web site, and 
setting the estimated click rate to approximately equal to the estimated 

percentage ; [[and]] 

determining, by one or more processors of the one or more server devices, whether 
the advertisement kern has been click spammed based at least in part on the determined estimated 
click rate for the group of non-malicious users , where the determining whether the advertisement has 
been click spammed includes: 

comparing the determined estimated click rate of the advertisement to an 
actual overall click rate of the advertisement, and 

determining that the advertisement has been click spammed when the actual 
overall click rate exceeds the determined estimated click rate; and 

taking remedial measures in response to determining that the advertisement has been 
click spammed . 

20-24. (Canceled herein) 
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25. (Currently amended) The method of claim [[24]] 19^ where the determining whether 
the advertisement item has been click spammed further includes: 

determining whether the [[an]] actual overall click rate of the advertisement item for 
the group of non-malicious users differs from the determined estimated click rate by at least a 
predetermined [[set]] percentage of clicks of the item . 

26. (Currently amended) The method of claim 19* where the determining the estimated 
[[a]] click rate of the advertisement item includes: 

determining different estimated click rates of the advertisement item for the group of 
non-malicious users, the different estimated click rates corresponding to different time periods. 

27. (Currently amended) The method of claim 26 A where the different time periods 
include different times of a day or week. 

28. (Currently amended) The method of claim 26 A where the different time periods 
include different months of a year. 

29. (Currently amended) A non-transitory computer-readable memory device containing 
instructions for controlling at least one processor to perform a method for detecting a spamming of 
an advertisement presented displayed by a server, the method comprising: 

identifying non-malicious visitors to the server, where identifying the non-malicious 
visitors includes identifying that the non malicious visitors are not spam programs; 

tracking an activity of users visiting the server, where the tracking includes 
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determining, for each user, at least one of whether the user loads images, an age of a cookie 

associated with the user, whether the user has javascript turned on, a type of browser used by the 

user, or an interval at which the user visits the server, and 

identifying the non-malicious visitors based on the tracked activity, where the 

non-malicious visitors include visitors that load images, have a cookie that is older than a 

predetermined age, have javascript turned on, are using a predetermined type of browser, or have 

visited the web site at an interval that exceeds a threshold interval ; 

determining an estimated [[a]] click rate of the advertisement for the non-malicious 

visitors , where the determining the estimated click rate includes: 

estimating a percentage of non-malicious visitors visiting the server, and 
setting the estimated click rate to approximately equal to the estimated 

percentage ; [[and]] 

determining whether the advertisement has been spammed based at least in part on 
the determined estimated click rate for the non-malicious visitors , where the determining whether the 
advertisement has been spammed includes: 

comparing the determined estimated click rate of the advertisement to an 
actual click rate of the advertisement, and 

determining that the advertisement has been spammed when the actual overall 
click rate exceeds the determined estimated click rate; and 

taking remedial measures in response to determining that the advertisement has been 

spammed . 



30. (Canceled herein) 
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3 1 . (Currently amended) A method performed by one or more processors of one or more 
server devices, the method comprising: 

tracking, by one or more processors of the one or more server devices, activities of 
users visiting a web site that includes one or more advertising links, the tracking including 
determining, for each user of a plurality of the users , at least one of: 
whether [[the]] said each user loads images, 
an age of a cookie associated with said each user, 
whether [[the]] said each user has javascript turned on, 
a type of browser used by [[the]] said each user, or 
an interval at which [[the]] said each user visits the web site; 
identifying, by one or more processors of the one or more server devices, non- 
malicious users from among the users visiting the web site based at least in part on the tracked 
activities; 

determining, by one or more processors of the one or more server devices, whether 
the advertising link has been spammed, where the determining includes: 

determining an estimated click rate of the advertisement for the non-malicious 
users, where the determining the estimated click rate includes: 

estimating a percentage, based on the identifying, of non-malicious 
users visiting the web site, and 

setting the estimated click rate to approximately equal to the estimated 

percentage, 

comparing an actual click rate of the advertising link by non-malicious users 
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to the [[an]] estimated click rate of the advertising link by non-malicious users, where the estimated 

click rate is based at least in part on historical data that includes data indicating a click rate of the 

advertising link by non malicious users during a previous time period 

determining, based on the comparing, whether the actual click rate is greater 

than the estimated click rate; and 

taking a remedial measure when the occurrence of spamming on the web site is 

determined . 

32. (Canceled herein) 

33. (Previously canceled) 
34-41. (Canceled herein) 

42. (Currently amended) The method of claim 3 l a further comprising: 

determining a quantity of the identified non-malicious users that click clicks the 
advertisement link; and 

determining whether the advertisement has been spammed based at least in part on 
the determined quantity of the identified non-malicious users that clicks the advertisement. 

43. (Canceled herein) 

44. (Canceled herein) 
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45. (Currently amended) The method of claim 1^ where the determining that the 
occurrence of spamming has occurred on the web site further includes: 

determining, based at least in part on the comparing, that the identified first 
proportion is greater than the identified second proportion plus a predefined threshold. 

46. (Canceled herein) 

47. (New) A no n- transitory computer-readable memory device storing instructions for 
controlling at least one processor to perform a method comprising: 

collecting information associated with a group of users visiting a web site that 
includes an advertising link, where the group of users visiting the web site includes a set of non- 
malicious users and a different set of malicious users, where the collecting information includes 
tracking activities of the group of users visiting the web site; 

identifying the set of non-malicious users visiting the web site from the group of users 
visiting the web site based on the collected information; 

where the tracking activities includes at least one of: 

determining whether images are loaded by the users, in the group of users, 
where identifying the set of non-malicious users includes identifying users, in the group of users, 
that are determined as loading images, where the set of non-malicious users includes the users that 
are determined as loading images, 

determining whether the users, in the group of users, have javascript turned 
on, where identifying the set of non-malicious users includes identifying users, in the group of users, 
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that are determined as having javascript turned on, where the set of non-malicious users includes the 

users that are determined as having javascript turned on, 

determining a type of browser used by the users, in the group of users, where 
identifying the set of non-malicious users includes identifying users, in the group of users, that are 
determined as using a browser, where the set of non-malicious users includes the users that are 
determined as using a browser, 

determining a number of times during an interval that users, in the group of 
users, visit the web site, where identifying the set of malicious users includes identifying a first set of 
users, in the group of users, that are determined to have visited the web site a number of times, 
during the interval, that exceeds a threshold number of times, where the set of non-malicious users 
includes a second set of users, in the group of users, that is different from the identified first set of 
users, 

determining, when the web site is associated with a search engine, a type of 
items for which searches are performed by the users in the group of users, where identifying the set 
of malicious users includes identifying a first set of users, in the group of users, that are determined 
to have performed searches in an ordered manner, where the set of non-malicious users includes a 
second set of users, in the group of users, that is different from the first set of users, or 

identifying non-malicious users based on an age of cookie identifiers 
associated with the users in the group of users; 

determining, by one or more processors of the one or more server devices, an 
estimated click rate of an advertisement, the estimate click rate being equal to a first proportion of a 
quantity of non-malicious users visiting the web site to a total quantity of users visiting the web site; 

detecting an occurrence of spamming of the advertising link on the web site, where 
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the detecting includes: 

identifying a second proportion of a quantity of clicks on the advertising link 
by identified non-malicious users to a total quantity of clicks on the advertising link by the group of 
users, 

comparing the determined estimated click rate to the identified second 

proportion, and 

determining that the spamming has occurred when the determined estimated 
click rate is greater than the identified second proportion; and 

taking a remedial measure when the occurrence of spamming on the web site is 

detected. 

48. (New) The non-transitory computer-readable memory device of claim 47, where the 
method further includes: 

identifying the non-malicious users based on network addresses associated with the 

users. 

49. (New) The non-transitory computer-readable memory device of claim 47, where 
taking the remedial measure comprises: 

providing a refund in response to detecting the occurrence of spamming on the 

web site. 

50. (New) A method performed by one or more processors of one or more server devices, 
the method comprising: 
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tracking, by one or more processors of the one or more server devices, activities of 
users visiting a web site that includes an advertising link, the tracking including determining, for 
each of a plurality of the users, at least one of: 

whether said each user loads images, 
an age of a cookie associated with said each user, 
whether said each user has javascript turned on, 
a type of browser used by said each user, or 
an interval at which said each user visits the web site; 
identifying, by one or more processors of the one or more server devices, non- 
malicious users from among the users visiting the web site based on the tracked activities; 

determining, by one or more processors of the one or more server devices, whether 
the advertising link has been spammed, where the determining includes: 

comparing an actual click rate of the advertising link to an expected click rate 
of the advertising link by non-malicious users, where the expected click rate is based on historical 
data associated with the advertising link, and 

determining, based on the comparing, that the advertising link has been 
spammed when the actual click rate is greater than the expected click rate; and 

taking a remedial measure upon determining that the advertising link has been 

spammed. 

5 1 . (New) The method of claim 50, further comprising: 

determining the actual click rate of the advertising link. 
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52. (New) The method of claim 50, where the actual click rate is an overall click rate 

associated with the advertising link. 
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